From 2cf9b3f393633f43746047e779fdf265a1ad8016 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@apache.org>
Date: Wed, 3 Jun 2026 17:09:40 +0000
Subject: [PATCH] Merge r1934932 from trunk:

* modules/ldap/util_ldap.c (uldap_connection_find): Fix inheritance in
  per-dir context.

Reviewed by: jorton, covener, jfclere


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1934935 13f79535-47bb-0310-9956-ffa450edef68

Conflict:no
Reference:https://github.com/apache/httpd/commit/2cf9b3f39
---
 modules/ldap/util_ldap.c | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/modules/ldap/util_ldap.c b/modules/ldap/util_ldap.c
index cf57b3d23cc..96e70044757 100644
--- a/modules/ldap/util_ldap.c
+++ b/modules/ldap/util_ldap.c
@@ -897,8 +897,23 @@ static util_ldap_connection_t *
          */
         l->secure = secureflag;
 
-        /* save away a copy of the client cert list that is presently valid */
-        l->client_certs = apr_array_copy_hdr(l->pool, dc->client_certs);
+        /* Deep-copy the client cert list into the connection pool so that
+         * the cached connection does not retain pointers into the
+         * (potentially short-lived) per-directory config pool.
+         */
+        l->client_certs = apr_array_copy(l->pool, dc->client_certs);
+        if (!apr_is_empty_array(l->client_certs)) {
+            int i;
+            apr_ldap_opt_tls_cert_t *certs;
+
+            certs = (apr_ldap_opt_tls_cert_t *)l->client_certs->elts;
+            for (i = 0; i < l->client_certs->nelts; i++) {
+                if (certs[i].path)
+                    certs[i].path = apr_pstrdup(l->pool, certs[i].path);
+                if (certs[i].password)
+                    certs[i].password = apr_pstrdup(l->pool, certs[i].password);
+            }
+        }
 
         /* whether or not to keep this connection in the pool when it's returned */
         l->keep = (st->connection_pool_ttl == 0) ? 0 : 1;